diff --git a/xkb/xkb.c b/xkb/xkb.c index 5f6420f9e..6e718df8b 100644 --- a/xkb/xkb.c +++ b/xkb/xkb.c @@ -2990,6 +2990,8 @@ _XkbSetCompatMap(ClientPtr client, DeviceIntPtr dev, XkbSymInterpretPtr sym; unsigned int skipped = 0; + if ((unsigned) (req->firstSI + req->nSI) > USHRT_MAX) + return BadValue; if ((unsigned) (req->firstSI + req->nSI) > compat->size_si) { compat->num_si = compat->size_si = req->firstSI + req->nSI; compat->sym_interpret = reallocarray(compat->sym_interpret,